OP(1)

NAME
op - operator access

SYNOPSIS
op mnemonic [arg]

DESCRIPTION
The op tool provides a flexible means for system administrators to grant trusted users access to certain root operations without having to give them full superuser privileges. Different sets of users may access different operations, and the security-related aspects of environment of each operation can be carefully controlled.

The fields of the entries in op.access are separated by white space. Each entry may span several lines and continues until the next alphanumeric string is found at the beginning of a lines (which is taken to be the next mnemonic, and thus the beginning of a new entry). Comments may be embedded beginning with a # character. Each entry in op op.access has the following form:
    mnemonic    command [ arg ... ] ; [ option ... ]
where the fields are interpreted in the following manner:

mnemonic
    a unique, alphanumeric identifier for each operator function.

command
    the full pathname of the executable to be run by op when the associated mnemonic is chosen.

arg(s)
    any arguments, either literal or variable, needed by command. Literal arguments are simply specified directly, like specific command options (0Gun) or files (/dev/rmt20). Variable arguments are specified here as $1, $2 ... $n; these are described more fully in the options section below. $* indicates any number trailing arguments.

option(s)
    a set of optional parameters to specify settings or restoring for the particular mnemonic, define variable arguments specified for the command, space and are of the form keyword=value. The absence of a specific list of values separated by commas, where appropriate. There should be no white space in each element of the value string unless quoted. The keyword is any of the following types:

uid Set the user id to the value specified. The value can be numeric user ID or a login name. The default is root.

gid Set the group id's to the values specified. Each value can be a numeric group ID or a group name.

dir Change the current working directory to the path specified.

chroot
    Change the root directory to the path specified using chroot.

umask
    Set the file creation umask to the octal value specified. The default is to set it to 022.

groups
    Allow any user who belongs to a group listed here to execute this op function. The default is not to allow any specific group.

users
    Allow any user listed here to execute this op function. The default is not allow any specific users. You may user the regular expression .* to indicate that all users may use this mnemonic.

password
    Queries the user for a password, if there is no = part the users own password is asked.

securid
    Queries the user for SecureID PIN and code. If op has been compiled without SecurID support, this option will cause the command to fail with an error message.

$VAR
    where VAR is the name of an environment variable. The specified environment case, simply using $VAR with no = part (as in $USER) means that this environment variable is inherited unchanged from the caller's shell.

environment
    Disables the destruction of the users environment.

$n  defines the nth variable argument specified in the command arg list. The value for this type may be a comma-separated list of regular expressions using egrep(1). option defines the range of values allowed for the variable arguments A variable argument specified as a command arg but not described in the options section may take on any value. If an argument does not match any of its permitted values, then a diagnostic is printed and the command is not executed. When using '(' syntax to pass values to other options, only the next options can use values from the previous search.

$*  is used in the options section to place restriction on the trailing arguments specified as $* in the args section. If any of these (possibly many) arguments do not match, then a diagnostic is printed, and the command is not executed.

There can also be a special entry in the file beginning at the first non-comment line that can define default values to override the builtin defaults listed here, yet still be overridden by any entry that wants to redefine any of the keyword fields described above. It should have the following format:
    DEFAULT    keyword_option
where keyword_option is a keyword=value string mentioned above under options.

It should be noted that if any regular mnemonic entry defines its own option, the value given for that entry must explicitly include the item from the DEFAULT line if the default values is to be included. That is, the options definitions completely override any defaults; they do not add to them In this way, if a value specified on the DEFAULT line for users or groups (for example) needs to be "erased" without redefining new values (that is, we want no users or groups to be allowed to run the mnemonic), then the default value must be overridden with nothing (as in users=). For the users or groups fields, such a null setting has the effect of setting the list of allowable users or groups to be empty. For the other keywords ( uid, gid, dir, chroot, and umask), a null setting leaves that attribute as it is upon invocation of the op program, overriding any defaults.

Another note is that if the command for a mnemonic is MAGIC_SHELL then a shell (using the users $SHELL environment variable) is created, if there are arguments in addition to the mnemonic on the command line then the shell is invoked "-c args".

FILES
/etc/op.access    access control description

SEE ALSO
su(1), chroot(2), egrep(1)

CREDIT
Op: A flexible Tool for Restricted Superuser Access , by Tom Christiansen , CONVEX Computer Corporation, Proceedings of the Large Installation Systems Administration III Workshop

BUG REPORTS TO
op-bugs@egbok.com

COPYRIGHTS
© Copyright 1991 by David Koblas

© Portions Copyright 1995, 1997 by Howard Owen